diff --git a/pkg/providers/v1/aws.go b/pkg/providers/v1/aws.go
index af8217e..e9e5f2d 100644
--- a/pkg/providers/v1/aws.go
+++ b/pkg/providers/v1/aws.go
@@ -4613,6 +4613,12 @@ func (c *Cloud) updateInstanceSecurityGroupsForLoadBalancer(lb *elb.LoadBalancer
 	c.sortELBSecurityGroupList(lbSecurityGroupIDs, annotations)
 	loadBalancerSecurityGroupID := lbSecurityGroupIDs[0]
 
+	var deleteSecurityGroupID bool
+	// we shouldn't delete Ingress SG rule, if it allows access
+	// from configured "ElbSecurityGroup", so that we won't disrupt access to Nodes from other ELBs
+	if loadBalancerSecurityGroupID != c.cfg.Global.ElbSecurityGroup {
+		deleteSecurityGroupID = true
+	}
 	// Get the actual list of groups that allow ingress from the load-balancer
 	var actualGroups []*ec2.SecurityGroup
 	{
@@ -4708,7 +4714,7 @@ func (c *Cloud) updateInstanceSecurityGroupsForLoadBalancer(lb *elb.LoadBalancer
 			if !changed {
 				klog.Warning("Allowing ingress was not needed; concurrent change? groupId=", instanceSecurityGroupID)
 			}
-		} else {
+		} else if deleteSecurityGroupID {
 			changed, err := c.removeSecurityGroupIngress(instanceSecurityGroupID, permissions)
 			if err != nil {
 				return err
